What’s Vulnerable › Vulnerabilities

CVE-2020-26240: Erroneous Proof of Work calculation in geth

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-25 · updated 2026-06-17
• Weakness: CWE-682

Description

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24

Affected products

• ethereum go-ethereum: before 1.9.24 — fixed in 1.9.24

How to fix

Upgrade to a fixed version: ethereum go-ethereum 1.9.24. Check the vendor advisory for mitigations.

References

• https://blog.ethereum.org/2020/11/12/geth_security_release/
• https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0
• https://github.com/ethereum/go-ethereum/pull/21793
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p
• https://blog.ethereum.org/2020/11/12/geth_security_release/
• https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0
• https://github.com/ethereum/go-ethereum/pull/21793
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p

Get alerted when CVE-2020-26240 or the next vulnerability affects your stack